Siemens S7 driver

PLC settings, connection steps and common errors for connecting to S7-1500, S7-1200 and S7-300 / 400 CPUs via PUT/GET and reading and writing tags with absolute addresses (DB, M, I, Q).

When to use it

The three drivers (Siemens S7-1500, Siemens S7-1200, Siemens S7-300 / 400) use the same protocol: S7 communication, PUT/GET, TCP port 102. Tags are given with an absolute address (DB1.DBX0.0, MW20). The S7-1500 and S7-1200 drivers have the same set of parameters, addresses and data types; only their IDs differ (s7-1500, s7-1200). The S7-300 / 400 driver has no LReal and SInt types, and its default slot is 2.

If the data block has Optimized block access enabled (symbolic) or if you need secure communication, this driver is not suitable; use the OPC UA driver.

Prerequisites on the PLC side

1. Allow PUT/GET access

   The CPU properties must allow access by a remote partner through PUT/GET communication (in TIA Portal: CPU properties › Protection and security › Connection mechanisms; menu names may vary depending on the TIA version). If it is off, the CPU rejects the requests and Live reports a PUT/GET error.

2. Turn off "Optimized block access" in the data block

   Optimized block access must be cleared in the properties of every data block you want to read, so that the byte addresses of the variables are fixed. Recompile the block and load it to the CPU. Take the bit, byte and word addresses from the Offset column of the block.

3. Find out the rack and slot

   On S7-1200 / 1500, the CPU is in rack 0, slot 1. On S7-300, the slot is 2. On S7-400, take the rack and slot in which the CPU is installed from the hardware configuration.

4. Network access

   The Live computer and the PLC must be on the same network, and any firewall between them must allow TCP port 102.

Setting up a connection

1. Add a connection

   In the Connections section, click Add and, as the Communication driver, select the S7 driver that matches your CPU.

2. Address and port

   Enter the IP address of the CPU in the IP address / computer name cell. The port remains 102.

3. Rack and slot

   In the Inspector, enter the Rack (0 – 7) and Slot (0 – 31) fields. Slot tooltip: The slot the CPU is plugged into: 2 for S7-300, 1 for S7-1200 / 1500.

4. Add a tag

   In the HMI tags section, create tags bound to this connection. The address cell validates the address as you type and shows its resolution below the cell (Tag addresses).

   1234

   1. Connection — the PLC connection the tag is bound to.
   2. Data type — determines the size letter of the address.
   3. Address — absolute S7 address (DB30.DBD2).
   4. Address resolution — the resolution of the address or an error.

5. Test

   Online›Test connections… only shows that TCP port 102 is open; the S7 session and the PUT/GET permission are tried only in Live, when a tag is read (Connection diagnostics).

Address and data type notes

• The size letter must match the type: Bool → DBX / M10.3, Byte and SInt → DBB / MB, Int and UInt → DBW / MW, DInt, UDInt and Real → DBD / MD.
• Long types (LReal, String, WString, DateTime) take no size letter; the start byte is given in the form DB1.DBX24.0 (DBB is also accepted). These types can be held only in a data block and in the bit memory area.
• String has the STRING[n] format of the PLC (2 byte header + n characters, Windows-1254 encoding). The Length field of the tag is the maximum number of characters to read (default 32, maximum 254); it must be the same as the definition in the PLC. A text longer than the maximum length in the PLC cannot be written.
• WString occupies 2n + 4 bytes as UTF-16.
• DateTime is read as DTL (12 bytes) on S7-1200 / 1500 and as DATE_AND_TIME (8 bytes) on S7-300 / 400.
• The address is not case-sensitive and may start with %; the German notations E (input) and A (output) are also accepted.
• Tags that are close to each other (with a gap of at most 32 bytes in the same area) are read in a single request; the read is split into multi-variable requests according to the PDU size negotiated with the PLC.

Driver reference

The parameter, address format and example tables below are generated from the driver definition in Studio. For S7-1200, the S7-1500 section applies.

Siemens S7-1500

"Permit access with PUT/GET" must be enabled on the CPU; "Optimized block access" must be disabled in the data block. Optimized (symbolic) blocks are accessed with the OPC UA driver.

Driver ID

s7-1500 (name in the project file)

Connection

An IP address / computer name and a port are required (default port 102)

Data types

Bool Byte SInt Int UInt DInt UDInt Real LReal String WString DateTime

Connection parameters

Appears in the Inspector window when a connection is selected.

Address formats

Sample addresses

Siemens S7-300 / 400

The S7-300 / 400 family has no LReal type.

Driver ID

s7-300 (name in the project file)

Connection

An IP address / computer name and a port are required (default port 102)

Data types

Bool Byte Int UInt DInt UDInt Real String DateTime

Connection parameters

Appears in the Inspector window when a connection is selected.

Address formats

Sample addresses

Common errors

The marker at the start of each line tells where the message will appear in Live: [connection] in the Connections section of the system menu; [write] in the notification window of the operator who performed the write; [Studio] in the address cell in Studio. [tag] is a tag error during reading: the tag is left with bad quality, the text of the message is not shown in Live in this version (Tag errors); read the text to understand the cause.

Tips